In short
- CVE-2026-27126 is a MEDIUM (CVSS 4.8) vulnerability affecting craftcms/cms, craft cms (craftcms).
- Chance of exploitation in the next 30 days (EPSS): 0.25%, higher than 15.9% of all vulnerabilities.
- Fix: update to 4.16.19, 5.8.23 or later.
| Package | Affected versions | Patched versions |
|---|
| craftcms/cms Packagist | ≥ 4.5.0-RC1, < 4.16.19≥ 5.0.0-RC1, < 5.8.23
| 4.16.195.8.23
|
| craft cms | = 4.5.0= 5.0.0> 4.5.0, < 4.16.19> 5.0.0, < 5.8.23
| 4.16.195.8.23
|
Description
A stored Cross-site Scripting (XSS) vulnerability exists in the editableTable.twig component when using the html column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.
Prerequisites
Steps to Reproduce
- Navigate to Settings → Fields and create a new field with Type: Table
- Add a Column Heading and set Column Type to
Single-line text
- Note: The vulnerable Column Type is
html, but it's not available in the UI dropdown.
- In Default Values section, add a row with the following payload:
<img src=x onerror="alert('XSS')">
- Enable
Static Rows
- Intercept the Save Field request using a proxy tool (e.g., Burp Suite) or use
cURL directly
- Modify the request body and change the
types[craft-fields-Table][columns][col3][type] parameter from singleline to html
- Forward the request to save the field
- Use the field in any object (e.g. user profile fields) → then visit the any user's profile
- Notice the XSS execution
- The XSS will also trigger when an administrator attempts to edit this field, as the malicious payload is executed within the field configuration page, too.
Resources
https://github.com/craftcms/cms/commit/f5d488d9bb6eff7670ed2c2fe30e15692e92c52b
NVD description
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.
More vulnerabilities in craftcms/cms
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free